

<!DOCTYPE html>
<html class="writer-html5" lang="en" >
<head>
  <meta charset="utf-8" />
  
  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
  
  <title>Session tags for Attribute Based Access Control in STS &mdash; Ceph Documentation</title>
  

  
  <link rel="stylesheet" href="../../_static/ceph.css" type="text/css" />
  <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />
  <link rel="stylesheet" href="../../_static/graphviz.css" type="text/css" />
  <link rel="stylesheet" href="../../_static/css/custom.css" type="text/css" />

  
  
    <link rel="shortcut icon" href="../../_static/favicon.ico"/>
  

  
  

  

  
  <!--[if lt IE 9]>
    <script src="../../_static/js/html5shiv.min.js"></script>
  <![endif]-->
  
    
      <script type="text/javascript" id="documentation_options" data-url_root="../../" src="../../_static/documentation_options.js"></script>
        <script src="../../_static/jquery.js"></script>
        <script src="../../_static/underscore.js"></script>
        <script src="../../_static/doctools.js"></script>
    
    <script type="text/javascript" src="../../_static/js/theme.js"></script>

    
    <link rel="index" title="Index" href="../../genindex/" />
    <link rel="search" title="Search" href="../../search/" />
    <link rel="next" title="Orphan List and Associated Tooling" href="../orphans/" />
    <link rel="prev" title="角色" href="../role/" /> 
</head>

<body class="wy-body-for-nav">

   
  <header class="top-bar">
    

















<div role="navigation" aria-label="breadcrumbs navigation">

  <ul class="wy-breadcrumbs">
    
      <li><a href="../../" class="icon icon-home"></a> &raquo;</li>
        
          <li><a href="../">Ceph 对象网关</a> &raquo;</li>
        
      <li>Session tags for Attribute Based Access Control in STS</li>
    
    
      <li class="wy-breadcrumbs-aside">
        
          
            <a href="../../_sources/radosgw/session-tags.rst.txt" rel="nofollow"> View page source</a>
          
        
      </li>
    
  </ul>

  
  <hr/>
</div>
  </header>
  <div class="wy-grid-for-nav">
    
    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
      <div class="wy-side-scroll">
        <div class="wy-side-nav-search"  style="background: #eee" >
          

          
            <a href="../../">
          

          
            
            <img src="../../_static/logo.png" class="logo" alt="Logo"/>
          
          </a>

          

          
<div role="search">
  <form id="rtd-search-form" class="wy-form" action="../../search/" method="get">
    <input type="text" name="q" placeholder="Search docs" />
    <input type="hidden" name="check_keywords" value="yes" />
    <input type="hidden" name="area" value="default" />
  </form>
</div>

          
        </div>

        
        <div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="main navigation">
          
            
            
              
            
            
              <ul class="current">
<li class="toctree-l1"><a class="reference internal" href="../../start/intro/">Ceph 简介</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../install/">安装 Ceph</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../cephadm/">Cephadm</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../rados/">Ceph 存储集群</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../cephfs/">Ceph 文件系统</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../rbd/">Ceph 块设备</a></li>
<li class="toctree-l1 current"><a class="reference internal" href="../">Ceph 对象网关</a><ul class="current">
<li class="toctree-l2"><a class="reference internal" href="../frontends/">HTTP 前端</a></li>
<li class="toctree-l2"><a class="reference internal" href="../placement/">存储池归置与存储类</a></li>
<li class="toctree-l2"><a class="reference internal" href="../multisite/">多站配置</a></li>
<li class="toctree-l2"><a class="reference internal" href="../multisite-sync-policy/">多站同步策略配置</a></li>
<li class="toctree-l2"><a class="reference internal" href="../pools/">存储池的配置</a></li>
<li class="toctree-l2"><a class="reference internal" href="../config-ref/">配置参考</a></li>
<li class="toctree-l2"><a class="reference internal" href="../admin/">管理指南</a></li>
<li class="toctree-l2"><a class="reference internal" href="../s3/">S3 API</a></li>
<li class="toctree-l2"><a class="reference internal" href="../rgw-cache/">Data caching and CDN</a></li>
<li class="toctree-l2"><a class="reference internal" href="../swift/">Swift API</a></li>
<li class="toctree-l2"><a class="reference internal" href="../adminops/">管理操作 API</a></li>
<li class="toctree-l2"><a class="reference internal" href="../api/">Python 接口</a></li>
<li class="toctree-l2"><a class="reference internal" href="../nfs/">通过 NFS 导出</a></li>
<li class="toctree-l2"><a class="reference internal" href="../keystone/">与 OpenStack Keystone 对接</a></li>
<li class="toctree-l2"><a class="reference internal" href="../barbican/">与 OpenStack Barbican 对接</a></li>
<li class="toctree-l2"><a class="reference internal" href="../vault/">与 HashiCorp Vault 对接</a></li>
<li class="toctree-l2"><a class="reference internal" href="../kmip/">KMIP Integration</a></li>
<li class="toctree-l2"><a class="reference internal" href="../opa/">与 Open Policy Agent 对接</a></li>
<li class="toctree-l2"><a class="reference internal" href="../multitenancy/">多租户</a></li>
<li class="toctree-l2"><a class="reference internal" href="../compression/">压缩</a></li>
<li class="toctree-l2"><a class="reference internal" href="../ldap-auth/">LDAP 认证</a></li>
<li class="toctree-l2"><a class="reference internal" href="../encryption/">服务器端加密</a></li>
<li class="toctree-l2"><a class="reference internal" href="../bucketpolicy/">桶策略</a></li>
<li class="toctree-l2"><a class="reference internal" href="../dynamicresharding/">动态的桶索引重分片</a></li>
<li class="toctree-l2"><a class="reference internal" href="../mfa/">多因子认证</a></li>
<li class="toctree-l2"><a class="reference internal" href="../sync-modules/">同步模块</a></li>
<li class="toctree-l2"><a class="reference internal" href="../notifications/">Bucket Notifications</a></li>
<li class="toctree-l2"><a class="reference internal" href="../layout/">RADOS 中的数据布局</a></li>
<li class="toctree-l2"><a class="reference internal" href="../STS/">STS</a></li>
<li class="toctree-l2"><a class="reference internal" href="../STSLite/">STS Lite</a></li>
<li class="toctree-l2"><a class="reference internal" href="../keycloak/">Keycloak</a></li>
<li class="toctree-l2"><a class="reference internal" href="../role/">Role</a></li>
<li class="toctree-l2 current"><a class="current reference internal" href="#">Session Tags</a><ul>
<li class="toctree-l3"><a class="reference internal" href="#tag-keys">Tag Keys</a></li>
<li class="toctree-l3"><a class="reference internal" href="#more-examples-of-policies-using-tags">More examples of policies using tags</a></li>
<li class="toctree-l3"><a class="reference internal" href="#properties-of-session-tags">Properties of Session Tags</a></li>
<li class="toctree-l3"><a class="reference internal" href="#s3-resource-tags">s3 Resource Tags</a></li>
<li class="toctree-l3"><a class="reference internal" href="#sample-code-demonstrating-usage-of-session-tags">Sample code demonstrating usage of session tags</a></li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="../orphans/">Orphan List and Associated Tooliing</a></li>
<li class="toctree-l2"><a class="reference internal" href="../oidc/">OpenID Connect Provider</a></li>
<li class="toctree-l2"><a class="reference internal" href="../troubleshooting/">故障排除</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../man/8/radosgw/">radosgw 手册页</a></li>
<li class="toctree-l2"><a class="reference internal" href="../../man/8/radosgw-admin/">radosgw-admin 手册页</a></li>
<li class="toctree-l2"><a class="reference internal" href="../qat-accel/">使用 QAT 为加密和压缩提速</a></li>
<li class="toctree-l2"><a class="reference internal" href="../s3select/">S3-select</a></li>
<li class="toctree-l2"><a class="reference internal" href="../lua-scripting/">Lua Scripting</a></li>
<li class="toctree-l2"><a class="reference internal" href="../d3n_datacache/">D3N Data Cache</a></li>
<li class="toctree-l2"><a class="reference internal" href="../cloud-transition/">Cloud Transition</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../../mgr/">Ceph 管理器守护进程</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../mgr/dashboard/">Ceph 仪表盘</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../api/">API 文档</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../architecture/">体系结构</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../dev/developer_guide/">开发者指南</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../dev/internals/">Ceph 内幕</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../governance/">项目管理</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../foundation/">Ceph 基金会</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../ceph-volume/">ceph-volume</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../releases/general/">Ceph 版本（总目录）</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../releases/">Ceph 版本（索引）</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../security/">Security</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../glossary/">Ceph 术语</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../jaegertracing/">Tracing</a></li>
<li class="toctree-l1"><a class="reference internal" href="../../translation_cn/">中文版翻译资源</a></li>
</ul>

            
          
        </div>
        
      </div>
    </nav>

    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap">

      
      <nav class="wy-nav-top" aria-label="top navigation">
        
          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
          <a href="../../">Ceph</a>
        
      </nav>


      <div class="wy-nav-content">
        
        <div class="rst-content">
        
          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
           <div itemprop="articleBody">
            
<div id="dev-warning" class="admonition note">
  <p class="first admonition-title">Notice</p>
  <p class="last">This document is for a development version of Ceph.</p>
</div>
  <div id="docubetter" align="right" style="padding: 5px; font-weight: bold;">
    <a href="https://pad.ceph.com/p/Report_Documentation_Bugs">Report a Documentation Bug</a>
  </div>

  
  <div class="section" id="session-tags-for-attribute-based-access-control-in-sts">
<h1>Session tags for Attribute Based Access Control in STS<a class="headerlink" href="#session-tags-for-attribute-based-access-control-in-sts" title="Permalink to this headline">¶</a></h1>
<p>Session tags are key-value pairs that can be passed while federating a user (currently it
is only supported as part of the web token passed to AssumeRoleWithWebIdentity). The session
tags are passed along as aws:PrincipalTag in the session credentials (temporary credentials)
that is returned back by STS. These Principal Tags consists of the session tags that come in
as part of the web token and the tags that are attached to the role being assumed. Please note
that the tags have to be always specified in the following namespace: https://aws.amazon.com/tags.</p>
<p>An example of the session tags that are passed in by the IDP in the web token is as follows:</p>
<div class="highlight-python notranslate"><div class="highlight"><pre><span></span><span class="p">{</span>
    <span class="s2">&quot;jti&quot;</span><span class="p">:</span> <span class="s2">&quot;947960a3-7e91-4027-99f6-da719b0d4059&quot;</span><span class="p">,</span>
    <span class="s2">&quot;exp&quot;</span><span class="p">:</span> <span class="mi">1627438044</span><span class="p">,</span>
    <span class="s2">&quot;nbf&quot;</span><span class="p">:</span> <span class="mi">0</span><span class="p">,</span>
    <span class="s2">&quot;iat&quot;</span><span class="p">:</span> <span class="mi">1627402044</span><span class="p">,</span>
    <span class="s2">&quot;iss&quot;</span><span class="p">:</span> <span class="s2">&quot;http://localhost:8080/auth/realms/quickstart&quot;</span><span class="p">,</span>
    <span class="s2">&quot;aud&quot;</span><span class="p">:</span> <span class="s2">&quot;app-profile-jsp&quot;</span><span class="p">,</span>
    <span class="s2">&quot;sub&quot;</span><span class="p">:</span> <span class="s2">&quot;test&quot;</span><span class="p">,</span>
    <span class="s2">&quot;typ&quot;</span><span class="p">:</span> <span class="s2">&quot;ID&quot;</span><span class="p">,</span>
    <span class="s2">&quot;azp&quot;</span><span class="p">:</span> <span class="s2">&quot;app-profile-jsp&quot;</span><span class="p">,</span>
    <span class="s2">&quot;auth_time&quot;</span><span class="p">:</span> <span class="mi">0</span><span class="p">,</span>
    <span class="s2">&quot;session_state&quot;</span><span class="p">:</span> <span class="s2">&quot;3a46e3e7-d198-4a64-8b51-69682bcfc670&quot;</span><span class="p">,</span>
    <span class="s2">&quot;preferred_username&quot;</span><span class="p">:</span> <span class="s2">&quot;test&quot;</span><span class="p">,</span>
    <span class="s2">&quot;email_verified&quot;</span><span class="p">:</span> <span class="n">false</span><span class="p">,</span>
    <span class="s2">&quot;acr&quot;</span><span class="p">:</span> <span class="s2">&quot;1&quot;</span><span class="p">,</span>
    <span class="s2">&quot;https://aws.amazon.com/tags&quot;</span><span class="p">:</span> <span class="p">[</span>
        <span class="p">{</span>
            <span class="s2">&quot;principal_tags&quot;</span><span class="p">:</span> <span class="p">{</span>
                <span class="s2">&quot;Department&quot;</span><span class="p">:</span> <span class="p">[</span>
                    <span class="s2">&quot;Engineering&quot;</span><span class="p">,</span>
                    <span class="s2">&quot;Marketing&quot;</span>
                <span class="p">]</span>
            <span class="p">}</span>
        <span class="p">}</span>
    <span class="p">],</span>
    <span class="s2">&quot;client_id&quot;</span><span class="p">:</span> <span class="s2">&quot;app-profile-jsp&quot;</span><span class="p">,</span>
    <span class="s2">&quot;username&quot;</span><span class="p">:</span> <span class="s2">&quot;test&quot;</span><span class="p">,</span>
    <span class="s2">&quot;active&quot;</span><span class="p">:</span> <span class="n">true</span>
<span class="p">}</span>
</pre></div>
</div>
<p>Steps to configure Keycloak to pass tags in the web token are described here:doc:<cite>keycloak</cite>.</p>
<p>The trust policy must have ‘sts:TagSession’ permission if the web token passed in by the federated user contains session tags, otherwise
the AssumeRoleWithWebIdentity action will fail. An example of the trust policy with sts:TagSession is as follows:</p>
<div class="highlight-python notranslate"><div class="highlight"><pre><span></span><span class="p">{</span>
        <span class="s2">&quot;Version&quot;</span><span class="p">:</span><span class="s2">&quot;2012-10-17&quot;</span><span class="p">,</span>
        <span class="s2">&quot;Statement&quot;</span><span class="p">:[</span>
        <span class="p">{</span>
            <span class="s2">&quot;Effect&quot;</span><span class="p">:</span><span class="s2">&quot;Allow&quot;</span><span class="p">,</span>
            <span class="s2">&quot;Action&quot;</span><span class="p">:[</span><span class="s2">&quot;sts:AssumeRoleWithWebIdentity&quot;</span><span class="p">,</span><span class="s2">&quot;sts:TagSession&quot;</span><span class="p">],</span>
            <span class="s2">&quot;Principal&quot;</span><span class="p">:{</span><span class="s2">&quot;Federated&quot;</span><span class="p">:[</span><span class="s2">&quot;arn:aws:iam:::oidc-provider/localhost:8080/auth/realms/quickstart&quot;</span><span class="p">]},</span>
            <span class="s2">&quot;Condition&quot;</span><span class="p">:{</span><span class="s2">&quot;StringEquals&quot;</span><span class="p">:{</span><span class="s2">&quot;localhost:8080/auth/realms/quickstart:sub&quot;</span><span class="p">:</span><span class="s2">&quot;test&quot;</span><span class="p">}}</span>
        <span class="p">}]</span>
    <span class="p">}</span>
</pre></div>
</div>
<div class="section" id="tag-keys">
<h2>Tag Keys<a class="headerlink" href="#tag-keys" title="Permalink to this headline">¶</a></h2>
<p>The following are the tag keys that can be used in the role’s trust policy or the role’s permission policy:</p>
<p>1. aws:RequestTag: This key is used to compare the key-value pair passed in the request with the key-value pair
in the role’s trust policy. In case of AssumeRoleWithWebIdentity, the session tags that are passed by the idp
in the web token can be used as aws:RequestTag in the role’s trust policy based on which a federated user can be
allowed to assume a role.</p>
<p>An example of a role trust policy that uses aws:RequestTag is as follows:</p>
<div class="highlight-python notranslate"><div class="highlight"><pre><span></span><span class="p">{</span>
        <span class="s2">&quot;Version&quot;</span><span class="p">:</span><span class="s2">&quot;2012-10-17&quot;</span><span class="p">,</span>
        <span class="s2">&quot;Statement&quot;</span><span class="p">:[</span>
        <span class="p">{</span>
            <span class="s2">&quot;Effect&quot;</span><span class="p">:</span><span class="s2">&quot;Allow&quot;</span><span class="p">,</span>
            <span class="s2">&quot;Action&quot;</span><span class="p">:[</span><span class="s2">&quot;sts:AssumeRoleWithWebIdentity&quot;</span><span class="p">,</span><span class="s2">&quot;sts:TagSession&quot;</span><span class="p">],</span>
            <span class="s2">&quot;Principal&quot;</span><span class="p">:{</span><span class="s2">&quot;Federated&quot;</span><span class="p">:[</span><span class="s2">&quot;arn:aws:iam:::oidc-provider/localhost:8080/auth/realms/quickstart&quot;</span><span class="p">]},</span>
            <span class="s2">&quot;Condition&quot;</span><span class="p">:{</span><span class="s2">&quot;StringEquals&quot;</span><span class="p">:{</span><span class="s2">&quot;aws:RequestTag/Department&quot;</span><span class="p">:</span><span class="s2">&quot;Engineering&quot;</span><span class="p">}}</span>
        <span class="p">}]</span>
    <span class="p">}</span>
</pre></div>
</div>
<p>2. aws:PrincipalTag: This key is used to compare the key-value pair attached to the principal with the key-value pair
in the policy. In case of AssumeRoleWithWebIdentity, the session tags that are passed by the idp in the web token appear
as Principal tags in the temporary credentials once a user has been authenticated, and these tags can be used as
aws:PrincipalTag in the role’s permission policy.</p>
<p>An example of a role permission policy that uses aws:PrincipalTag is as follows:</p>
<div class="highlight-python notranslate"><div class="highlight"><pre><span></span><span class="p">{</span>
        <span class="s2">&quot;Version&quot;</span><span class="p">:</span><span class="s2">&quot;2012-10-17&quot;</span><span class="p">,</span>
        <span class="s2">&quot;Statement&quot;</span><span class="p">:[</span>
        <span class="p">{</span>
            <span class="s2">&quot;Effect&quot;</span><span class="p">:</span><span class="s2">&quot;Allow&quot;</span><span class="p">,</span>
            <span class="s2">&quot;Action&quot;</span><span class="p">:[</span><span class="s2">&quot;s3:*&quot;</span><span class="p">],</span>
        <span class="s2">&quot;Resource&quot;</span><span class="p">:[</span><span class="s2">&quot;arn:aws:s3::t1tenant:my-test-bucket&quot;</span><span class="p">,</span><span class="s2">&quot;arn:aws:s3::t1tenant:my-test-bucket/*],&quot;</span><span class="o">+</span>
            <span class="s2">&quot;Condition&quot;</span><span class="p">:{</span><span class="s2">&quot;StringEquals&quot;</span><span class="p">:{</span><span class="s2">&quot;aws:PrincipalTag/Department&quot;</span><span class="p">:</span><span class="s2">&quot;Engineering&quot;</span><span class="p">}}</span>
        <span class="p">}]</span>
    <span class="p">}</span>
</pre></div>
</div>
<p>3. iam:ResourceTag: This key is used to compare the key-value pair attached to the resource with the key-value pair
in the policy. In case of AssumeRoleWithWebIdentity, tags attached to the role can be used to compare with that in
the trust policy to allow a user to assume a role.
RGW now supports REST APIs for tagging, listing tags and untagging actions on a role. More information related to
role tagging can be found here <a class="reference internal" href="../role/"><span class="doc">角色</span></a>.</p>
<p>An example of a role’s trust policy that uses aws:ResourceTag is as follows:</p>
<div class="highlight-python notranslate"><div class="highlight"><pre><span></span><span class="p">{</span>
        <span class="s2">&quot;Version&quot;</span><span class="p">:</span><span class="s2">&quot;2012-10-17&quot;</span><span class="p">,</span>
        <span class="s2">&quot;Statement&quot;</span><span class="p">:[</span>
        <span class="p">{</span>
            <span class="s2">&quot;Effect&quot;</span><span class="p">:</span><span class="s2">&quot;Allow&quot;</span><span class="p">,</span>
            <span class="s2">&quot;Action&quot;</span><span class="p">:[</span><span class="s2">&quot;sts:AssumeRoleWithWebIdentity&quot;</span><span class="p">,</span><span class="s2">&quot;sts:TagSession&quot;</span><span class="p">],</span>
            <span class="s2">&quot;Principal&quot;</span><span class="p">:{</span><span class="s2">&quot;Federated&quot;</span><span class="p">:[</span><span class="s2">&quot;arn:aws:iam:::oidc-provider/localhost:8080/auth/realms/quickstart&quot;</span><span class="p">]},</span>
            <span class="s2">&quot;Condition&quot;</span><span class="p">:{</span><span class="s2">&quot;StringEquals&quot;</span><span class="p">:{</span><span class="s2">&quot;iam:ResourceTag/Department&quot;</span><span class="p">:</span><span class="s2">&quot;Engineering&quot;</span><span class="p">}}</span>
        <span class="p">}]</span>
    <span class="p">}</span>
</pre></div>
</div>
<p>For the above to work, you need to attach ‘Department=Engineering’ tag to the role.</p>
<p>4. aws:TagKeys: This key is used to compare tags in the request with the tags in the policy. In case of
AssumeRoleWithWebIdentity this can be used to check the tag keys in a role’s trust policy before a user
is allowed to assume a role.
This can also be used in the role’s permission policy.</p>
<p>An example of a role’s trust policy that uses aws:TagKeys is as follows:</p>
<div class="highlight-python notranslate"><div class="highlight"><pre><span></span><span class="p">{</span>
        <span class="s2">&quot;Version&quot;</span><span class="p">:</span><span class="s2">&quot;2012-10-17&quot;</span><span class="p">,</span>
        <span class="s2">&quot;Statement&quot;</span><span class="p">:[</span>
        <span class="p">{</span>
            <span class="s2">&quot;Effect&quot;</span><span class="p">:</span><span class="s2">&quot;Allow&quot;</span><span class="p">,</span>
            <span class="s2">&quot;Action&quot;</span><span class="p">:[</span><span class="s2">&quot;sts:AssumeRoleWithWebIdentity&quot;</span><span class="p">,</span><span class="s2">&quot;sts:TagSession&quot;</span><span class="p">],</span>
            <span class="s2">&quot;Principal&quot;</span><span class="p">:{</span><span class="s2">&quot;Federated&quot;</span><span class="p">:[</span><span class="s2">&quot;arn:aws:iam:::oidc-provider/localhost:8080/auth/realms/quickstart&quot;</span><span class="p">]},</span>
            <span class="s2">&quot;Condition&quot;</span><span class="p">:{</span><span class="s2">&quot;ForAllValues:StringEquals&quot;</span><span class="p">:{</span><span class="s2">&quot;aws:TagKeys&quot;</span><span class="p">:[</span><span class="s2">&quot;Marketing,Engineering&quot;</span><span class="p">]}}</span>
        <span class="p">}]</span>
    <span class="p">}</span>
</pre></div>
</div>
<p>‘ForAllValues:StringEquals’ tests whether every tag key in the request is a subset of the tag keys in the policy. So the above
condition restricts the tag keys passed in the request.</p>
<p>5. s3:ResourceTag: This key is used to compare tags present on the s3 resource (bucket or object) with the tags in
the role’s permission policy.</p>
<p>An example of a role’s permission policy that uses s3:ResourceTag is as follows:</p>
<div class="highlight-python notranslate"><div class="highlight"><pre><span></span><span class="p">{</span>
    <span class="s2">&quot;Version&quot;</span><span class="p">:</span><span class="s2">&quot;2012-10-17&quot;</span><span class="p">,</span>
    <span class="s2">&quot;Statement&quot;</span><span class="p">:[</span>
    <span class="p">{</span>
        <span class="s2">&quot;Effect&quot;</span><span class="p">:</span><span class="s2">&quot;Allow&quot;</span><span class="p">,</span>
        <span class="s2">&quot;Action&quot;</span><span class="p">:[</span><span class="s2">&quot;s3:PutBucketTagging&quot;</span><span class="p">],</span>
        <span class="s2">&quot;Resource&quot;</span><span class="p">:[</span><span class="s2">&quot;arn:aws:s3::t1tenant:my-test-bucket</span><span class="se">\&quot;</span><span class="s2">,&quot;</span><span class="n">arn</span><span class="p">:</span><span class="n">aws</span><span class="p">:</span><span class="n">s3</span><span class="p">::</span><span class="n">t1tenant</span><span class="p">:</span><span class="n">my</span><span class="o">-</span><span class="n">test</span><span class="o">-</span><span class="n">bucket</span><span class="o">/*</span><span class="s2">&quot;]</span>
    <span class="p">},</span>
    <span class="p">{</span>
        <span class="s2">&quot;Effect&quot;</span><span class="p">:</span><span class="s2">&quot;Allow&quot;</span><span class="p">,</span>
        <span class="s2">&quot;Action&quot;</span><span class="p">:[</span><span class="s2">&quot;s3:*&quot;</span><span class="p">],</span>
        <span class="s2">&quot;Resource&quot;</span><span class="p">:[</span><span class="s2">&quot;*&quot;</span><span class="p">],</span>
        <span class="s2">&quot;Condition&quot;</span><span class="p">:{</span><span class="s2">&quot;StringEquals&quot;</span><span class="p">:{</span><span class="s2">&quot;s3:ResourceTag/Department&quot;</span><span class="p">:</span>\<span class="s2">&quot;Engineering&quot;</span><span class="p">}}</span>
    <span class="p">}</span>
<span class="p">}</span>
</pre></div>
</div>
<p>For the above to work, you need to attach ‘Department=Engineering’ tag to the bucket (and on the object too) on which you want this policy
to be applied.</p>
</div>
<div class="section" id="more-examples-of-policies-using-tags">
<h2>More examples of policies using tags<a class="headerlink" href="#more-examples-of-policies-using-tags" title="Permalink to this headline">¶</a></h2>
<p>1. To assume a role by matching the tags in the incoming request with the tag attached to the role.
aws:RequestTag is the incoming tag in the JWT (access token) and iam:ResourceTag is the tag attached to the role being assumed:</p>
<div class="highlight-python notranslate"><div class="highlight"><pre><span></span><span class="p">{</span>
        <span class="s2">&quot;Version&quot;</span><span class="p">:</span><span class="s2">&quot;2012-10-17&quot;</span><span class="p">,</span>
        <span class="s2">&quot;Statement&quot;</span><span class="p">:[</span>
        <span class="p">{</span>
            <span class="s2">&quot;Effect&quot;</span><span class="p">:</span><span class="s2">&quot;Allow&quot;</span><span class="p">,</span>
            <span class="s2">&quot;Action&quot;</span><span class="p">:[</span><span class="s2">&quot;sts:AssumeRoleWithWebIdentity&quot;</span><span class="p">,</span><span class="s2">&quot;sts:TagSession&quot;</span><span class="p">],</span>
            <span class="s2">&quot;Principal&quot;</span><span class="p">:{</span><span class="s2">&quot;Federated&quot;</span><span class="p">:[</span><span class="s2">&quot;arn:aws:iam:::oidc-provider/localhost:8080/auth/realms/quickstart&quot;</span><span class="p">]},</span>
            <span class="s2">&quot;Condition&quot;</span><span class="p">:{</span><span class="s2">&quot;StringEquals&quot;</span><span class="p">:{</span><span class="s2">&quot;aws:RequestTag/Department&quot;</span><span class="p">:</span><span class="s2">&quot;${iam:ResourceTag/Department}&quot;</span><span class="p">}}</span>
        <span class="p">}]</span>
    <span class="p">}</span>
</pre></div>
</div>
<p>2. To evaluate a role’s permission policy by matching principal tags with s3 resource tags.
aws:PrincipalTag is the tag passed in along with the temporary credentials and s3:ResourceTag is the tag attached to
the s3 resource (object/ bucket):</p>
<div class="highlight-python notranslate"><div class="highlight"><pre><span></span><span class="p">{</span>
    <span class="s2">&quot;Version&quot;</span><span class="p">:</span><span class="s2">&quot;2012-10-17&quot;</span><span class="p">,</span>
    <span class="s2">&quot;Statement&quot;</span><span class="p">:[</span>
    <span class="p">{</span>
        <span class="s2">&quot;Effect&quot;</span><span class="p">:</span><span class="s2">&quot;Allow&quot;</span><span class="p">,</span>
        <span class="s2">&quot;Action&quot;</span><span class="p">:[</span><span class="s2">&quot;s3:PutBucketTagging&quot;</span><span class="p">],</span>
        <span class="s2">&quot;Resource&quot;</span><span class="p">:[</span><span class="s2">&quot;arn:aws:s3::t1tenant:my-test-bucket</span><span class="se">\&quot;</span><span class="s2">,&quot;</span><span class="n">arn</span><span class="p">:</span><span class="n">aws</span><span class="p">:</span><span class="n">s3</span><span class="p">::</span><span class="n">t1tenant</span><span class="p">:</span><span class="n">my</span><span class="o">-</span><span class="n">test</span><span class="o">-</span><span class="n">bucket</span><span class="o">/*</span><span class="s2">&quot;]</span>
    <span class="p">},</span>
    <span class="p">{</span>
        <span class="s2">&quot;Effect&quot;</span><span class="p">:</span><span class="s2">&quot;Allow&quot;</span><span class="p">,</span>
        <span class="s2">&quot;Action&quot;</span><span class="p">:[</span><span class="s2">&quot;s3:*&quot;</span><span class="p">],</span>
        <span class="s2">&quot;Resource&quot;</span><span class="p">:[</span><span class="s2">&quot;*&quot;</span><span class="p">],</span>
        <span class="s2">&quot;Condition&quot;</span><span class="p">:{</span><span class="s2">&quot;StringEquals&quot;</span><span class="p">:{</span><span class="s2">&quot;s3:ResourceTag/Department&quot;</span><span class="p">:</span><span class="s2">&quot;${aws:PrincipalTag/Department}&quot;</span><span class="p">}}</span>
    <span class="p">}</span>
<span class="p">}</span>
</pre></div>
</div>
</div>
<div class="section" id="properties-of-session-tags">
<h2>Properties of Session Tags<a class="headerlink" href="#properties-of-session-tags" title="Permalink to this headline">¶</a></h2>
<ol class="arabic simple">
<li><p>Session Tags can be multi-valued. (Multi-valued session tags are not supported in AWS)</p></li>
<li><p>A maximum of 50 session tags are allowed to be passed in by the IDP.</p></li>
<li><p>The maximum size of a key allowed is 128 characters.</p></li>
<li><p>The maximum size of a value allowed is 256 characters.</p></li>
<li><p>The tag or the value can not start with “aws:”.</p></li>
</ol>
</div>
<div class="section" id="s3-resource-tags">
<h2>s3 Resource Tags<a class="headerlink" href="#s3-resource-tags" title="Permalink to this headline">¶</a></h2>
<p>As stated above ‘s3:ResourceTag’ key can be used for authorizing an s3 operation in RGW (this is not allowed in AWS).</p>
<p>s3:ResourceTag is a key used to refer to tags that have been attached to an object or a bucket. Tags can be attached to an object or
a bucket using REST APIs available for the same.</p>
<p>The following table shows which s3 resource tag type (bucket/object) are supported for authorizing a particular operation.</p>
<table class="docutils align-default">
<colgroup>
<col style="width: 65%" />
<col style="width: 35%" />
</colgroup>
<thead>
<tr class="row-odd"><th class="head"><p>Operation</p></th>
<th class="head"><p>Tag type</p></th>
</tr>
</thead>
<tbody>
<tr class="row-even"><td><p><strong>GetObject</strong>
<strong>GetObjectTags</strong>
<strong>DeleteObjectTags</strong>
<strong>DeleteObject</strong>
<strong>PutACLs</strong>
<strong>InitMultipart</strong>
<strong>AbortMultipart</strong>
<strong>ListMultipart</strong>
<strong>GetAttrs</strong>
<strong>PutObjectRetention</strong>
<strong>GetObjectRetention</strong>
<strong>PutObjectLegalHold</strong>
<strong>GetObjectLegalHold</strong></p></td>
<td><p>Object tags</p></td>
</tr>
<tr class="row-odd"><td><p><strong>PutObjectTags</strong>
<strong>GetBucketTags</strong>
<strong>PutBucketTags</strong>
<strong>DeleteBucketTags</strong>
<strong>GetBucketReplication</strong>
<strong>DeleteBucketReplication</strong>
<strong>GetBucketVersioning</strong>
<strong>SetBucketVersioning</strong>
<strong>GetBucketWebsite</strong>
<strong>SetBucketWebsite</strong>
<strong>DeleteBucketWebsite</strong>
<strong>StatBucket</strong>
<strong>ListBucket</strong>
<strong>GetBucketLogging</strong>
<strong>GetBucketLocation</strong>
<strong>DeleteBucket</strong>
<strong>GetLC</strong>
<strong>PutLC</strong>
<strong>DeleteLC</strong>
<strong>GetCORS</strong>
<strong>PutCORS</strong>
<strong>GetRequestPayment</strong>
<strong>SetRequestPayment</strong>
<strong>PutBucketPolicy</strong>
<strong>GetBucketPolicy</strong>
<strong>DeleteBucketPolicy</strong>
<strong>PutBucketObjectLock</strong>
<strong>GetBucketObjectLock</strong>
<strong>GetBucketPolicyStatus</strong>
<strong>PutBucketPublicAccessBlock</strong>
<strong>GetBucketPublicAccessBlock</strong>
<strong>DeleteBucketPublicAccessBlock</strong></p></td>
<td><p>Bucket tags</p></td>
</tr>
<tr class="row-even"><td><p><strong>GetACLs</strong>
<strong>PutACLs</strong></p></td>
<td><p>Bucket tags for
bucket ACLs
Object tags for
object ACLs</p></td>
</tr>
<tr class="row-odd"><td><p><strong>PutObject</strong>
<strong>CopyObject</strong></p></td>
<td><p>Object tags of
source object
Bucket tags of
destination bucket</p></td>
</tr>
</tbody>
</table>
</div>
<div class="section" id="sample-code-demonstrating-usage-of-session-tags">
<h2>Sample code demonstrating usage of session tags<a class="headerlink" href="#sample-code-demonstrating-usage-of-session-tags" title="Permalink to this headline">¶</a></h2>
<p>The following is a sample code for tagging a role, a bucket, an object in it and using tag keys in a role’s
trust policy and its permission policy, assuming that a tag ‘Department=Engineering’ is passed in the
JWT (access token) by the IDP</p>
<div class="highlight-python notranslate"><div class="highlight"><pre><span></span><span class="c1"># -*- coding: utf-8 -*-</span>

<span class="kn">import</span> <span class="nn">boto3</span>
<span class="kn">import</span> <span class="nn">json</span>
<span class="kn">from</span> <span class="nn">nose.tools</span> <span class="kn">import</span> <span class="n">eq_</span> <span class="k">as</span> <span class="n">eq</span>

<span class="n">access_key</span> <span class="o">=</span> <span class="s1">&#39;TESTER&#39;</span>
<span class="n">secret_key</span> <span class="o">=</span> <span class="s1">&#39;test123&#39;</span>
<span class="n">endpoint</span> <span class="o">=</span> <span class="s1">&#39;http://s3.us-east.localhost:8000&#39;</span>

<span class="n">s3client</span> <span class="o">=</span> <span class="n">boto3</span><span class="o">.</span><span class="n">client</span><span class="p">(</span><span class="s1">&#39;s3&#39;</span><span class="p">,</span>
<span class="n">aws_access_key_id</span> <span class="o">=</span> <span class="n">access_key</span><span class="p">,</span>
<span class="n">aws_secret_access_key</span> <span class="o">=</span> <span class="n">secret_key</span><span class="p">,</span>
<span class="n">endpoint_url</span> <span class="o">=</span> <span class="n">endpoint</span><span class="p">,</span>
<span class="n">region_name</span><span class="o">=</span><span class="s1">&#39;&#39;</span><span class="p">,)</span>

<span class="n">s3res</span> <span class="o">=</span> <span class="n">boto3</span><span class="o">.</span><span class="n">resource</span><span class="p">(</span><span class="s1">&#39;s3&#39;</span><span class="p">,</span>
        <span class="n">aws_access_key_id</span> <span class="o">=</span> <span class="n">access_key</span><span class="p">,</span>
        <span class="n">aws_secret_access_key</span> <span class="o">=</span> <span class="n">secret_key</span><span class="p">,</span>
        <span class="n">endpoint_url</span> <span class="o">=</span> <span class="n">endpoint</span><span class="p">,</span>
        <span class="n">region_name</span><span class="o">=</span><span class="s1">&#39;&#39;</span><span class="p">,)</span>

<span class="n">iam_client</span> <span class="o">=</span> <span class="n">boto3</span><span class="o">.</span><span class="n">client</span><span class="p">(</span><span class="s1">&#39;iam&#39;</span><span class="p">,</span>
<span class="n">aws_access_key_id</span><span class="o">=</span><span class="n">access_key</span><span class="p">,</span>
<span class="n">aws_secret_access_key</span><span class="o">=</span><span class="n">secret_key</span><span class="p">,</span>
<span class="n">endpoint_url</span><span class="o">=</span><span class="n">endpoint</span><span class="p">,</span>
<span class="n">region_name</span><span class="o">=</span><span class="s1">&#39;&#39;</span>
<span class="p">)</span>

<span class="n">bucket_name</span> <span class="o">=</span> <span class="s1">&#39;test-bucket&#39;</span>
<span class="n">s3bucket</span> <span class="o">=</span> <span class="n">s3client</span><span class="o">.</span><span class="n">create_bucket</span><span class="p">(</span><span class="n">Bucket</span><span class="o">=</span><span class="n">bucket_name</span><span class="p">)</span>

<span class="n">bucket_tagging</span> <span class="o">=</span> <span class="n">s3res</span><span class="o">.</span><span class="n">BucketTagging</span><span class="p">(</span><span class="n">bucket_name</span><span class="p">)</span>
<span class="n">Set_Tag</span> <span class="o">=</span> <span class="n">bucket_tagging</span><span class="o">.</span><span class="n">put</span><span class="p">(</span><span class="n">Tagging</span><span class="o">=</span><span class="p">{</span><span class="s1">&#39;TagSet&#39;</span><span class="p">:[{</span><span class="s1">&#39;Key&#39;</span><span class="p">:</span><span class="s1">&#39;Department&#39;</span><span class="p">,</span> <span class="s1">&#39;Value&#39;</span><span class="p">:</span> <span class="s1">&#39;Engineering&#39;</span><span class="p">}]})</span>
<span class="k">try</span><span class="p">:</span>
    <span class="n">response</span> <span class="o">=</span> <span class="n">iam_client</span><span class="o">.</span><span class="n">create_open_id_connect_provider</span><span class="p">(</span>
        <span class="n">Url</span><span class="o">=</span><span class="s1">&#39;http://localhost:8080/auth/realms/quickstart&#39;</span><span class="p">,</span>
        <span class="n">ClientIDList</span><span class="o">=</span><span class="p">[</span>
            <span class="s1">&#39;app-profile-jsp&#39;</span><span class="p">,</span>
            <span class="s1">&#39;app-jee-jsp&#39;</span>
        <span class="p">],</span>
        <span class="n">ThumbprintList</span><span class="o">=</span><span class="p">[</span>
            <span class="s1">&#39;F7D7B3515DD0D319DD219A43A9EA727AD6065287&#39;</span>
    <span class="p">]</span>
    <span class="p">)</span>
<span class="k">except</span> <span class="n">ClientError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
    <span class="nb">print</span> <span class="p">(</span><span class="s2">&quot;Provider already exists&quot;</span><span class="p">)</span>

<span class="n">policy_document</span> <span class="o">=</span> <span class="s2">&quot;{</span><span class="se">\&quot;</span><span class="s2">Version</span><span class="se">\&quot;</span><span class="s2">:</span><span class="se">\&quot;</span><span class="s2">2012-10-17</span><span class="se">\&quot;</span><span class="s2">,</span><span class="se">\&quot;</span><span class="s2">Statement</span><span class="se">\&quot;</span><span class="s2">:[{</span><span class="se">\&quot;</span><span class="s2">Effect</span><span class="se">\&quot;</span><span class="s2">:</span><span class="se">\&quot;</span><span class="s2">Allow</span><span class="se">\&quot;</span><span class="s2">,</span><span class="se">\&quot;</span><span class="s2">Principal</span><span class="se">\&quot;</span><span class="s2">:{</span><span class="se">\&quot;</span><span class="s2">Federated</span><span class="se">\&quot;</span><span class="s2">:[</span><span class="se">\&quot;</span><span class="s2">arn:aws:iam:::oidc-provider/localhost:8080/auth/realms/quickstart</span><span class="se">\&quot;</span><span class="s2">]},</span><span class="se">\&quot;</span><span class="s2">Action</span><span class="se">\&quot;</span><span class="s2">:[</span><span class="se">\&quot;</span><span class="s2">sts:AssumeRoleWithWebIdentity</span><span class="se">\&quot;</span><span class="s2">,</span><span class="se">\&quot;</span><span class="s2">sts:TagSession</span><span class="se">\&quot;</span><span class="s2">],</span><span class="se">\&quot;</span><span class="s2">Condition</span><span class="se">\&quot;</span><span class="s2">:{</span><span class="se">\&quot;</span><span class="s2">StringEquals</span><span class="se">\&quot;</span><span class="s2">:{</span><span class="se">\&quot;</span><span class="s2">aws:RequestTag/Department</span><span class="se">\&quot;</span><span class="s2">:</span><span class="se">\&quot;</span><span class="s2">${iam:ResourceTag/Department}</span><span class="se">\&quot;</span><span class="s2">}}}]}&quot;</span>
<span class="n">role_response</span> <span class="o">=</span> <span class="s2">&quot;&quot;</span>

<span class="nb">print</span> <span class="p">(</span><span class="s2">&quot;</span><span class="se">\n</span><span class="s2"> Getting Role </span><span class="se">\n</span><span class="s2">&quot;</span><span class="p">)</span>

<span class="k">try</span><span class="p">:</span>
    <span class="n">role_response</span> <span class="o">=</span> <span class="n">iam_client</span><span class="o">.</span><span class="n">get_role</span><span class="p">(</span>
        <span class="n">RoleName</span><span class="o">=</span><span class="s1">&#39;S3Access&#39;</span>
    <span class="p">)</span>
    <span class="nb">print</span> <span class="p">(</span><span class="n">role_response</span><span class="p">)</span>
<span class="k">except</span> <span class="n">ClientError</span> <span class="k">as</span> <span class="n">e</span><span class="p">:</span>
    <span class="k">if</span> <span class="n">e</span><span class="o">.</span><span class="n">response</span><span class="p">[</span><span class="s1">&#39;Code&#39;</span><span class="p">]</span> <span class="o">==</span> <span class="s1">&#39;NoSuchEntity&#39;</span><span class="p">:</span>
        <span class="nb">print</span> <span class="p">(</span><span class="s2">&quot;</span><span class="se">\n</span><span class="s2"> Creating Role </span><span class="se">\n</span><span class="s2">&quot;</span><span class="p">)</span>
        <span class="n">tags_list</span> <span class="o">=</span> <span class="p">[</span>
            <span class="p">{</span><span class="s1">&#39;Key&#39;</span><span class="p">:</span><span class="s1">&#39;Department&#39;</span><span class="p">,</span><span class="s1">&#39;Value&#39;</span><span class="p">:</span><span class="s1">&#39;Engineering&#39;</span><span class="p">},</span>
        <span class="p">]</span>
        <span class="n">role_response</span> <span class="o">=</span> <span class="n">iam_client</span><span class="o">.</span><span class="n">create_role</span><span class="p">(</span>
            <span class="n">AssumeRolePolicyDocument</span><span class="o">=</span><span class="n">policy_document</span><span class="p">,</span>
            <span class="n">Path</span><span class="o">=</span><span class="s1">&#39;/&#39;</span><span class="p">,</span>
            <span class="n">RoleName</span><span class="o">=</span><span class="s1">&#39;S3Access&#39;</span><span class="p">,</span>
            <span class="n">Tags</span><span class="o">=</span><span class="n">tags_list</span><span class="p">,</span>
        <span class="p">)</span>
        <span class="nb">print</span> <span class="p">(</span><span class="n">role_response</span><span class="p">)</span>
    <span class="k">else</span><span class="p">:</span>
        <span class="nb">print</span><span class="p">(</span><span class="s2">&quot;Unexpected error: </span><span class="si">%s</span><span class="s2">&quot;</span> <span class="o">%</span> <span class="n">e</span><span class="p">)</span>

<span class="n">role_policy</span> <span class="o">=</span> <span class="s2">&quot;{</span><span class="se">\&quot;</span><span class="s2">Version</span><span class="se">\&quot;</span><span class="s2">:</span><span class="se">\&quot;</span><span class="s2">2012-10-17</span><span class="se">\&quot;</span><span class="s2">,</span><span class="se">\&quot;</span><span class="s2">Statement</span><span class="se">\&quot;</span><span class="s2">:{</span><span class="se">\&quot;</span><span class="s2">Effect</span><span class="se">\&quot;</span><span class="s2">:</span><span class="se">\&quot;</span><span class="s2">Allow</span><span class="se">\&quot;</span><span class="s2">,</span><span class="se">\&quot;</span><span class="s2">Action</span><span class="se">\&quot;</span><span class="s2">:</span><span class="se">\&quot;</span><span class="s2">s3:*</span><span class="se">\&quot;</span><span class="s2">,</span><span class="se">\&quot;</span><span class="s2">Resource</span><span class="se">\&quot;</span><span class="s2">:</span><span class="se">\&quot;</span><span class="s2">arn:aws:s3:::*</span><span class="se">\&quot;</span><span class="s2">,</span><span class="se">\&quot;</span><span class="s2">Condition</span><span class="se">\&quot;</span><span class="s2">:{</span><span class="se">\&quot;</span><span class="s2">StringEquals</span><span class="se">\&quot;</span><span class="s2">:{</span><span class="se">\&quot;</span><span class="s2">s3:ResourceTag/Department</span><span class="se">\&quot;</span><span class="s2">:[</span><span class="se">\&quot;</span><span class="s2">${aws:PrincipalTag/Department}</span><span class="se">\&quot;</span><span class="s2">]}}}}&quot;</span>

<span class="n">response</span> <span class="o">=</span> <span class="n">iam_client</span><span class="o">.</span><span class="n">put_role_policy</span><span class="p">(</span>
            <span class="n">RoleName</span><span class="o">=</span><span class="s1">&#39;S3Access&#39;</span><span class="p">,</span>
            <span class="n">PolicyName</span><span class="o">=</span><span class="s1">&#39;Policy1&#39;</span><span class="p">,</span>
            <span class="n">PolicyDocument</span><span class="o">=</span><span class="n">role_policy</span>
        <span class="p">)</span>

<span class="n">sts_client</span> <span class="o">=</span> <span class="n">boto3</span><span class="o">.</span><span class="n">client</span><span class="p">(</span><span class="s1">&#39;sts&#39;</span><span class="p">,</span>
<span class="n">aws_access_key_id</span><span class="o">=</span><span class="s1">&#39;abc&#39;</span><span class="p">,</span>
<span class="n">aws_secret_access_key</span><span class="o">=</span><span class="s1">&#39;def&#39;</span><span class="p">,</span>
<span class="n">endpoint_url</span> <span class="o">=</span> <span class="n">endpoint</span><span class="p">,</span>
<span class="n">region_name</span> <span class="o">=</span> <span class="s1">&#39;&#39;</span><span class="p">,</span>
<span class="p">)</span>


<span class="nb">print</span> <span class="p">(</span><span class="s2">&quot;</span><span class="se">\n</span><span class="s2"> Assuming Role with Web Identity</span><span class="se">\n</span><span class="s2">&quot;</span><span class="p">)</span>
<span class="n">response</span> <span class="o">=</span> <span class="n">sts_client</span><span class="o">.</span><span class="n">assume_role_with_web_identity</span><span class="p">(</span>
<span class="n">RoleArn</span><span class="o">=</span><span class="n">role_response</span><span class="p">[</span><span class="s1">&#39;Role&#39;</span><span class="p">][</span><span class="s1">&#39;Arn&#39;</span><span class="p">],</span>
<span class="n">RoleSessionName</span><span class="o">=</span><span class="s1">&#39;Bob&#39;</span><span class="p">,</span>
<span class="n">DurationSeconds</span><span class="o">=</span><span class="mi">900</span><span class="p">,</span>
<span class="n">WebIdentityToken</span><span class="o">=</span><span class="s1">&#39;&lt;web-token&gt;&#39;</span><span class="p">)</span>

<span class="n">s3client2</span> <span class="o">=</span> <span class="n">boto3</span><span class="o">.</span><span class="n">client</span><span class="p">(</span><span class="s1">&#39;s3&#39;</span><span class="p">,</span>
<span class="n">aws_access_key_id</span> <span class="o">=</span> <span class="n">response</span><span class="p">[</span><span class="s1">&#39;Credentials&#39;</span><span class="p">][</span><span class="s1">&#39;AccessKeyId&#39;</span><span class="p">],</span>
<span class="n">aws_secret_access_key</span> <span class="o">=</span> <span class="n">response</span><span class="p">[</span><span class="s1">&#39;Credentials&#39;</span><span class="p">][</span><span class="s1">&#39;SecretAccessKey&#39;</span><span class="p">],</span>
<span class="n">aws_session_token</span> <span class="o">=</span> <span class="n">response</span><span class="p">[</span><span class="s1">&#39;Credentials&#39;</span><span class="p">][</span><span class="s1">&#39;SessionToken&#39;</span><span class="p">],</span>
<span class="n">endpoint_url</span><span class="o">=</span><span class="s1">&#39;http://s3.us-east.localhost:8000&#39;</span><span class="p">,</span>
<span class="n">region_name</span><span class="o">=</span><span class="s1">&#39;&#39;</span><span class="p">,)</span>

<span class="n">bucket_body</span> <span class="o">=</span> <span class="s1">&#39;this is a test file&#39;</span>
<span class="n">tags</span> <span class="o">=</span> <span class="s1">&#39;Department=Engineering&#39;</span>
<span class="n">key</span> <span class="o">=</span> <span class="s2">&quot;test-1.txt&quot;</span>
<span class="n">s3_put_obj</span> <span class="o">=</span> <span class="n">s3client2</span><span class="o">.</span><span class="n">put_object</span><span class="p">(</span><span class="n">Body</span><span class="o">=</span><span class="n">bucket_body</span><span class="p">,</span> <span class="n">Bucket</span><span class="o">=</span><span class="n">bucket_name</span><span class="p">,</span> <span class="n">Key</span><span class="o">=</span><span class="n">key</span><span class="p">,</span> <span class="n">Tagging</span><span class="o">=</span><span class="n">tags</span><span class="p">)</span>
<span class="n">eq</span><span class="p">(</span><span class="n">s3_put_obj</span><span class="p">[</span><span class="s1">&#39;ResponseMetadata&#39;</span><span class="p">][</span><span class="s1">&#39;HTTPStatusCode&#39;</span><span class="p">],</span><span class="mi">200</span><span class="p">)</span>

<span class="n">s3_get_obj</span> <span class="o">=</span> <span class="n">s3client2</span><span class="o">.</span><span class="n">get_object</span><span class="p">(</span><span class="n">Bucket</span><span class="o">=</span><span class="n">bucket_name</span><span class="p">,</span> <span class="n">Key</span><span class="o">=</span><span class="n">key</span><span class="p">)</span>
<span class="n">eq</span><span class="p">(</span><span class="n">s3_get_obj</span><span class="p">[</span><span class="s1">&#39;ResponseMetadata&#39;</span><span class="p">][</span><span class="s1">&#39;HTTPStatusCode&#39;</span><span class="p">],</span><span class="mi">200</span><span class="p">)</span>
</pre></div>
</div>
</div>
</div>



           </div>
           
          </div>
          <footer>
    <div class="rst-footer-buttons" role="navigation" aria-label="footer navigation">
        <a href="../orphans/" class="btn btn-neutral float-right" title="Orphan List and Associated Tooling" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
        <a href="../role/" class="btn btn-neutral float-left" title="角色" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
    </div>

  <hr/>

  <div role="contentinfo">
    <p>
        &#169; Copyright 2016, Ceph authors and contributors. Licensed under Creative Commons Attribution Share Alike 3.0 (CC-BY-SA-3.0).

    </p>
  </div> 

</footer>
        </div>
      </div>

    </section>

  </div>
  

  <script type="text/javascript">
      jQuery(function () {
          SphinxRtdTheme.Navigation.enable(true);
      });
  </script>

  
  
    
   

</body>
</html>